Skip to content

Commit

Permalink
[Doc] Optimize class registration doc (#1027)
Browse files Browse the repository at this point in the history
* refine register exception msg

* refine register doc

* revert copy
  • Loading branch information
chaokunyang authored Oct 26, 2023
1 parent f8883ee commit 56b5a15
Show file tree
Hide file tree
Showing 4 changed files with 11 additions and 5 deletions.
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ public class Example {
Fury fury = Fury.builder().withLanguage(Language.JAVA)
// Allow to deserialize objects unknown types, more flexible
// but may be insecure if the classes contains malicious code.
// .requireClassRegistration(false)
.requireClassRegistration(false)
.build();
// Registering types can reduce class name serialization overhead, but not mandatory.
// If class registration enabled, all custom types must be registered.
Expand All @@ -165,7 +165,7 @@ public class Example {
ThreadSafeFury fury = Fury.builder().withLanguage(Language.JAVA)
// Allow to deserialize objects unknown types, more flexible
// but may be insecure if the classes contains malicious code.
// .requireClassRegistration(false)
.requireClassRegistration(false)
.buildThreadSafeFury();
byte[] bytes = fury.serialize(object);
System.out.println(fury.deserialize(bytes));
Expand Down
4 changes: 4 additions & 0 deletions docs/guide/DEVELOPMENT.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
<!-- fury_frontmatter --
title: Java Object Graph Guide
order: 5
-- fury_frontmatter -->
# How to build to Fury

## Get the source code
Expand Down
2 changes: 1 addition & 1 deletion docs/guide/java_object_graph_guide.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ public class Example {
Fury fury = Fury.builder().withLanguage(Language.JAVA)
// Allow to deserialize objects unknown types, more flexible
// but may be insecure if the classes contains malicious code.
// .requireClassRegistration(false)
.requireClassRegistration(false)
.build();
// Registering types can reduce class name serialization overhead, but not mandatory.
// If class registration enabled, all custom types must be registered.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -1132,8 +1132,10 @@ private Serializer createSerializer(Class<?> cls) {
String msg =
String.format(
"%s is not registered, please check whether it's the type you want to serialize or "
+ "a **vulnerability**. If safe, registering class by "
+ "`Fury#register` will have better performance by skipping classname serialization",
+ "a **vulnerability**. If safe, you should invoke `Fury#register` to register class, "
+ " which will have better performance by skipping classname serialization. "
+ "If your env is 100%% secure, you can also avoid this exception by disabling class "
+ "registration check using `FuryBuilder#requireClassRegistration(false)`",
cls);
boolean forbidden = BlackList.getDefaultBlackList().contains(cls.getName());
if (forbidden || !isSecure(extRegistry.registeredClassIdMap, cls)) {
Expand Down

0 comments on commit 56b5a15

Please sign in to comment.